Cryptographic Hash Functions and Their Properties

Cryptographic Hash Functions similar to hash tables/hash functions from data structures looks like encryption, clear text goes in & gobbledygook comes out but it s not encryption maps data of an arbitrary size to a bit array of a fixed size "hash", or "message digest")

Cryptographic Hash Functions deterministic always generates the same hash given the same input fast to compute this is too hard given a hash value, figure out a message that would yield it so is this find two or more messages with the same hash it exhibits Claude s diffusion property

Cryptographic Hash Functions data MD5(lynx.cfg)= 1b734f5470ad18e362efcb11bd5907cc 1b734f5470ad18e362efcb11bd5907cc CHF fixed size bit array, shown here as hex digits this is the: fingerprint, message digest, or digest, hash, hash value, or more loosely sha256 named by the algorithm used, or incorrectly: checksum / crc (cyclic redundancy check) or these are all synonyms, meaning the output of the hash function or or not necessarily clear text, but can be . remember: this is not encryption though it looks a bit like it different terms tend to be used in different domains

Cryptographic Hash Functions 100 gigabytes input 32 bytes out C H F MD5(lynx.cfg)= 1b734f5470ad18e362efcb11bd5907cc 1b734f5470ad18e362efcb11bd5907cc 1 byte input 32 bytes out C H F MD5(lynx.cfg)= q7334f54e5ji8003jut309sxcdu7r99g q7334f54e5ji8003jut309sxcdu7r99g

Cryptographic Hash Functions Deterministic same hash every time given the same msg 1 way Avalanche small change in input = big change in output Finding collisions is difficult Finding the original msg is difficult there are infinitely many (but this is still worth considering)

Cryptographic Hash Functions But necessarily suffer from (infinitely many!) collisions Add ASCII values of letters to hash the words in English == 95% collision rate (given 3 * hash table size) Why necessarily necessarily?

Cryptographic Hash Functions And you can t go backwards You cannot decrypt a message digest to get the original document Why not? (to which of the infinitely many collision-producing clear text will it map?)

Cryptographic Hash Functions So one more time, what is the difference between a symmetric block cipher (like AES) and a cryptographic hash function ?

Cryptographic hash functions are often used for checksum equivalent password verification nonrepudiation protection of data in encrypted format proof-of-work building cryptographic primitives inter alia how? consider: password - encrypted vs hashed

Digital signature Hash functions what s going on here? and what does it accomplish?

DGST(1) OpenSSL DGST(1) NAME NAME openssl-dgst, dgst, sha, sha1, mdc2, ripemd160, sha224, sha256, sha384,sha512, md2, md4, md5, dss1 - message digests SYNOPSIS SYNOPSIS openssl openssl dgst [- -sha sha| |- -sha1| [- -c c] [- -d d] [- -hex [- -sign filename sign filename] [- -keyform [- -prverify prverify filename [- -non non- -fips fips- -allow dgst sha1|- -mdc2| - -sha512| sha512|- -md2| hex] [- -binary mdc2|- -ripemd160| ripemd160|- -sha224| md2|- -md4| md4|- -md5| binary] [- -r r] [- -non keyform arg filename] [- -signature filename signature filename] [- -hmac allow] [- -fips fips- -fingerprint fingerprint] [file... sha224|- -sha256| md5|- -dss1 dss1] non- -fips arg] [- -passin passin arg sha256|- -sha384 sha384| | fips- -allow allow] [- -out filename arg] [- -verify filename verify filename] hmac key key] file...] out filename]

$ echo "hi" | openssl dgst -sha256 (stdin)= 98ea6e4f216f2fb4b69fff9b3a44842c38686ca685f3f55dc48c5d3fb 1107be4 rjoyce9@ITEC-480-E15748 /etc $ echo "hi " | openssl dgst -sha256 (stdin)= 5400fc717d9b2543f5e24da4b2c52f196845455073fd7fcef704c7923 22a552c $ echo "hi" | openssl dgst -sha256 (stdin)= 98ea6e4f216f2fb4b69fff9b3a44842c38686ca685f3f55dc48c5d3fb 1107be4

Cryptographic Hash Functions rjoyce9@ITEC-480-E15748 /etc $ echo "this is much much much much much longer than the length of the resulting digest and, given the same radix, implies collisions" | openssl dgst -sha256 (stdin)= 11c5337d902b97bd8f0086a7394e52f0b9c2f2d1ddcaa2ccd6b868 2ba42e5442

Cryptographic Hash Functions Crypt(3) root:$6$eFYkdV/U$BV97G390/U.kaDnzpuhH2qkbCSJz/3QSfl7PT2BhGhYAczkjk1xWc 2i/xVv.3tX9YAIt9ofwFzb.Jt/UxtpEO1:19246:0:14600:14:::

One Time Pad OTP A perfect encryption algorithm (but squeezed in here as if it s barely worth spending time to discuss it) A cipher is unconditionally secure if it can t be broken with infinite computing resource

Say you have 10000 key bits An exhaustive search would try up to 2**10000 combinations Computational infeasible But it is not secure ( infinite , remember?) Suppose the cardinality of the keyspace is 100000000000000000000000 Somebody tries to search it anyway and the first one they try is it! (somebody wins the lottery, just not you)

Ciphers in use are (mostly) practically secure, but they are not unconditionally secure OTP is a stream cipher where the key stream bits come from a TRNG one bit for each message bit each key stream bit is used only one time

Each side needs to know the key The key is unique each time Sending the key to the other side is the same problem as sending the message when might one use this?

Extremely powerful Extremely simple loosely (very loosely) you can consider the ratio of the key size length to the plaintext length as a sort of secrecy measure Crypto solved? one time pad has a ratio >= 1, and uses TRNG why can t we still try all the keys? trying all possible keys doesn t help you at all, because all possible plaintexts are equally likely decryptions of the ciphertext.

Cryptography Landscape Can you explain/combine/label/group these? DES OTP Digital signature Symmetric encryption AES Block cipher Public Key Cryptography MD5 Transposition Feistel network Substitution Diffusion certificate Confusion Galois Fields PKI 3DES X.509 CA D-H TRNG SHA LFSR stream cipher RSA Web of Trust